Demand for data sniffer and watch dogs arising.
The competition to hire the best in the field, the experts who can sift through data and recognize patterns that indicate the presence of trespassers is cutthroat as cyber security has evolved into a multifaceted concern for corporations.
Software can only spot aberrant patterns in a corporation’s data logs to a certain extent. Only human analysts can notice code that shouldn’t be there in a software. Such experts are a rare and prized breed. And the demand for these niche analysts is enormous in today’s information age.
The “Global Information Security Workforce Study” produced by Frost & Sullivan, a US-based business consulting firm in collaboration with management and technology consulting firm Booz Allen Hamilton predicted that in 2013 alone, some 332,000 cybersecurity jobs would be added to payrolls worldwide, bringing total global employment in the field to 3.2 million, a growth of more than 10%.
Alberto Soliño, director of Program Management at CORE Security, a security research-and-response firm based in Buenos Aires, Argentina, says an authentic expert has several years of experience testing security and dealing with vulnerabilities; is up-to-date with the methods used by black hats (hackers); and has a deep understanding of the industry. “You don´t want to spend money (on consultants) for vulnerabilities that could be found by commercial testing tools. These types of profiles are rare and very expensive for an average mid-size company” Soliño said. According to Solino companies are better off employing a mix of in-house security professionals and a set of specialized, commercially available tools.
According to Alan Paller, director of research for the SANS Institute, a US-based security research and training group most “experts” today have little training in hands-on security; even fewer have the technical capacity to transform knowledge of existing threats into protection schemes for tomorrow’s attack. Instead, experts can be divided into three groups: policy analysts with no hands-on skills; hands-on firewall administrators and log analysers; and “hunters and tool-builders” who can analyse attack data and quickly update filters to block intruders. Unfortunately the policy analysts outnumber the other two groups by a factor of two to one. Paller says that “The hunters and tool-builders are getting paid US$130,000 to US$200,000 if you can find them, but they’re really, really hard to find.”
The head of the computer security incident response team at Paris, France-based Cassadian Cybersecurity, David Bizeul advises many smaller organizations can’t afford to give their security personnel the necessary resources to outsource cybersecurity to dedicated firms . “It can be tedious for a cybersecurity expert to work in a place where everything he will say sounds like a foreign language to his colleagues,” Bizeul said. “With the scarcity of such people, it might be more difficult for out-of-security-business companies to staff their corporate departments with experts.”
“If you are not in the business of IT, you’re more likely to get better service by going with a good cloud provider,” Richard Bejtlich, chief security officer at Mandiant, a security consultancy based in Alexandria, Virginia (USA) said. “But your mileage here all depends on which provider you select.” He urges companies to carefully scrutinize all cloud security providers. His advice: Create a checklist of requirements, then quiz the provider on how they measure up.
How can this scenario of scarcity of legitimate security experts be rectified? The answer, according Paller, probably won’t involve retraining existing policy people. “It’s going to be easier to build a massive pipeline of bright kids who can become this quickly,” he said. To encourage this solution several US states have already announced challenge programs that offer scholarships for a few dozen winners of intense-hacking competitions, Paller said; all 50 states are expected to announce such programs within the next year.
